Conventionally, there is known Electronic Control Units (ECUs) that are provided in a vehicle so as to electronically control respective various systems of the vehicle, such as an engine, a transmission, and a car navigation device. In each of these controllers, a built-in microcontroller (hereinafter, may be referred to as “microcomputer”) executes a control program so as to realize assigned various functions.
In this controller, for example, a power source Integrated Circuit (power source IC) functions as a monitoring unit for monitoring whether or not the microcomputer normally operates. There is conventionally known, as a microcomputer monitoring system, a watchdog counter (hereinafter, may be referred to as “WDC”) monitoring system for monitoring an interval between pulses of a WDC signal that is output from the microcomputer, for example.
There is also proposed, as another microcomputer monitoring system, a Q&A system using serial communication (see Japanese Laid-open Patent Publication No. 2015-108944, for example). In the Q&A system, a monitor IC periodically transmits, to a microcomputer, random data and an arithmetic-operation instruction etc. corresponding to “question”. The microcomputer arithmetically operates the random data caused by a specific arithmetic-operation instruction, and transmits the arithmetic-operation result to the monitor IC as “answer”.
When the answer of the microcomputer does not return at a defined communication timing or when the answer is evaluated not to be an expected one, the monitor IC determines that an operation abnormality occurs in the microcomputer and hard-resets the microcomputer by using power source control, for example.
There exists, in some cases, a case where such a control program of the controller is to be updated (reprogrammed) when a function is added thereto, or when an abnormality is found out after the fact. At the time of this updating in the microcomputer, a control program is temporarily stopped for the updating and an updating program is started so as to rewrite the control program.
However, the above conventional technology has room for improvement in preventing an erroneous reset performed by a monitoring unit in updating a control program.
Specifically, at the time of updating a control program, the microcomputer once stops the control program and performs program shifting for starting an updating program instead thereof, as described above, it is preferable that the microcomputer monitoring performed by the monitoring unit is to be continued so that an incorrect state, such as hang-up, is able to be detected even during the program shifting.
In this point, the updating program is able to answer to the monitoring unit instead of the control program so as to continue the microcomputer monitoring, however, processing load on the microcomputer side increases during the program shifting, for example, and thus disturbance is easily caused in a communication timing between the monitoring unit and the microcomputer etc.
When the above Q&A system is employed, the communication timing is more easily disturbed because the communication timing between the question and the answer is finely defined and further the serial communication having a comparatively low speed is employed. Thus, there exists a fear that this disturbance in the communication timing causes the monitoring unit to erroneously reset the microcomputer.